AcademySoftwareFoundation / AcademySoftwareFoundation/OpenCue

`test_rest_gateway_docker_compose.sh` with hard coded JWT secret: `Token validation error: token signature is invalid: signature is invalid`

Open
#2,127 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
957
Forks
259
Avg merge
3d 6h
Merged PRs (30d)
16

Description

**Describe the bug**
Running `test_rest_gateway_docker_compose.sh` against a `rest_gateway` container with a `JWT_SECRET` set other than
`default-secret-key`, most tests fail. Make sure tests respect `JWT_SECRET` environment variable if set:
https://github.com/AcademySoftwareFoundation/OpenCue/blob/ce61412b723c4020a6676842e175a228b3026daa/rest_gateway/test_rest_gateway_docker_compose.sh#L16

**To Reproduce**
Steps to reproduce the behavior:
Result with `JWT_SECRET` set in environment (value: `my-jwt-secret`):
```
Testing OpenCue REST Gateway with Docker Compose
=================================================
Checking Docker Compose services...
NAME IMAGE COMMAND SERVICE CREATED STATUS PORTS

Generating JWT token...
JWT token generated (length: 124)

Testing REST Gateway endpoints...
================================

1. Testing GetShows...
GetShows: FAILED
Response: Token validation error: token signature is invalid: signature is invalid

2. Testing GetJobs...
GetJobs: FAILED
Response: Token validation error: token signature is invalid: signature is invalid

3. Testing GetHosts...
GetHosts: FAILED
Response: Token validation error: token signature is invalid: signature is invalid

4. Testing FindShow...
FindShow: FAILED
Response: Token validation error: token signature is invalid: signature is invalid

5. Testing Frame Interface...
5a. GetFrame (will fail if no frame ID provided, but tests endpoint):
GetFrame: SUCCESS (endpoint accessible)
Token validation error: token signature is invalid: signature is invalid
...

6. Testing Layer Interface...
6a. GetLayer (will fail if no layer ID provided, but tests endpoint):
GetLayer: SUCCESS (endpoint accessible)
Token validation error: token signature is invalid: signature is invalid
...

7. Testing Group Interface...
7a. FindGroup:
FindGroup: SUCCESS (endpoint accessible)
Token validation error: token signature is invalid: signature is invalid

8. Testing Owner Interface...
8a. GetOwner:
GetOwner: SUCCESS (endpoint accessible)
Token validation error: token signature is invalid: signature is invalid

9. Testing Proc Interface...
9a. GetProc:
GetProc: SUCCESS (endpoint accessible)
Token validation error: token signature is invalid: signature is invalid
...

10. Testing Deed Interface...
10a. GetOwner (deed):
DeedInterface.GetOwner: SUCCESS (endpoint accessible)
Token validation error: token signature is invalid: signature is invalid
...

11. Testing Additional Job Interface Methods...
11a. FindJob:
FindJob: SUCCESS (endpoint accessible)
Token validation error: token signature is invalid: signature is invalid

12. Testing Additional Show Interface Methods...
12a. CreateShow (will likely fail due to permissions, but tests endpoint):
CreateShow: SUCCESS (endpoint accessible)
Token validation error: token signature is invalid: signature is invalid
...

13. Testing REST Gateway Status...
REST Gateway Response Status: Token validation error: token signature is invalid: signature is invalid
HTTP Status: 401

Testing Complete!
=================

Tested Interfaces and Available Endpoints:
- Show Interface: GetShows , FindShow , CreateShow
- Job Interface: GetJobs , FindJob , GetFrames, Kill, Pause, Resume
- Frame Interface: GetFrame , Retry, Kill, Eat
- Layer Interface: GetLayer , FindLayer, GetFrames, Kill
- Group Interface: FindGroup , GetGroup, SetMinCores, SetMaxCores
- Host Interface: GetHosts , FindHost, GetHost, Lock, Unlock
- Owner Interface: GetOwner , SetMaxCores, TakeOwnership
- Proc Interface: GetProc , Kill, Unbook
- Deed Interface: GetOwner , GetHost

Note: indicates endpoints tested in this script
Other endpoints are available but not tested here

REST Gateway URL: http://localhost:8448
JWT Token (valid for 1 hour): eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoidGVzdCIsImV4cCI6MTc2NjI0MDAzMH0.A94hwpDsffM0KRMaUcigHUamaeAOLrzk6HG_15C8y4s

Example usage:
curl -H "Authorization: Bearer $JWT_TOKEN" \
-H "Content-Type: application/json" \
-X POST "http://localhost:8448/./" \
-d '{"param": "value"}'
```

**Expected behavior**
Test script uses `JWT_SECRET` from environment if set. If not, use default secret.

Contributor guide

Open the contributing guide

Research direction

Inspect rest_gateway/test_rest_gateway_docker_compose.sh around line 16 and the JWT generation command; first run it with JWT_SECRET set. Done means the endpoint checks authenticate with the environment-provided secret while the default-secret case still works.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, docker-compose, shell
Domain
devops, testing-qa
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.